TCP Extensions for High Performance
obsoletes
- rfc-1323 — TCP Extensions for High Performance
Extracted elements (28)
For outdated timestamps on idle connections, TS.Recent invalidation (after 24 days of idle) was chosen over sending keep-alives at sub-wraparound intervals because the TCP specification has never included keep-alives, and the invalidation approach imposes no overhead.
PAWS uses the same TS.Recent value as RTTM (rather than tracking the timestamp of the last in-sequence segment separately) because it simplifies implementation. TS.Recent differs from the last in-sequence segment's timestamp only in the case of delayed ACKs, and the difference is less than one window — acceptable for wrap-around protection.
The timestamp check (H1) is specified to precede header prediction (H2) despite the performance argument for reversing them. Putting H2 first would create a hazard: a segment from 2^32 bytes in the past could arrive at the exact left window edge and be mistakenly accepted; the probabilistic argument was not universally accepted.
The timestamp clock frequency range of 1 ms to 1 sec per tick was chosen to satisfy both PAWS (must tick at least once per 2^31 bytes, and recycle time must exceed MSL) and RTTM (resolution need not exceed the granularity of the retransmit timer, i.e., tens to hundreds of milliseconds).
The Window Scale shift count is capped at 14 to ensure the maximum window (2^(S+16)) remains less than 2^30. This bound is required because TCP sequence number arithmetic determines 'old vs new' segments using 2^31 as the half-space, and allowing windows >= 2^30 would cause ambiguity between the sender's right edge and receiver's left edge.
Some paths and middleboxes sporadically suppress the Timestamps option while maintaining payload integrity. RFC 7323's stricter requirement that segments missing TSopt (after negotiation) be dropped may expose previously-hidden broken middlebox behavior, potentially resulting in unresponsive TCP sessions where RFC 1323 would have continued.
Any TCP implementation that implements PAWS MUST also implement Path MTU Discovery (RFC 1191, RFC 1981, RFC 4821), because PAWS protection can be circumvented by IP fragmentation reassembly errors at high data rates.
Both sides MUST send Window Scale options in their SYN segments to enable window scaling in either direction. A WSopt appearing in a segment without the SYN bit MUST be ignored.
If a TSopt is received on a connection where TSopt was not negotiated in the initial three-way handshake, the TSopt MUST be ignored and the packet processed normally.
Implementations MUST handle a shrinking (retracted) window as specified in RFC 1122 Section 4.2.2.16. The receiver MUST honor as in-window any segment that would have been in-window for any ACK previously sent.
Once TSopt is successfully negotiated (both SYN and SYN-ACK contain TSopt), it MUST be sent in every non-RST segment for the duration of the connection. If a non-RST segment is received without a TSopt, a TCP SHOULD silently drop the segment; it MUST NOT abort the connection due to a missing TSopt.
PAWS processing MUST be performed on all incoming segments for a synchronized connection and MUST take precedence over the regular TCP acceptability check (RFC 793 Section 3.3). A segment with SEG.TSval < TS.Recent (and valid TS.Recent, and RST bit not set) MUST be treated as unacceptable: send an ACK and drop the segment.
RST segments MUST NOT be subjected to the PAWS timestamp check, and timestamp information from RST segments MUST NOT be used to update connection state. However, it is RECOMMENDED that an RST generated in response to a segment with TSopt also carry TSopt, with TSecr set to the incoming TSval and TSval set to zero.
RTTM Rule: A TSecr value received in a segment MAY be used to update the averaged RTT measurement only if the segment advances the left edge of the send window (i.e., SND.UNA is increased), to prevent inflation from gaps in one-way data flows.
The incoming window field SEG.WND MUST be left-shifted by Snd.Wind.Shift before updating SND.WND (SND.WND = SEG.WND << Snd.Wind.Shift), and the outgoing window field MUST be right-shifted by Rcv.Wind.Shift (SEG.WND = RCV.WND >> Rcv.Wind.Shift), except for SYN segments.
The shift count MUST be limited to 14 (maximum window 2^30 = 1 GiB). If a Window Scale option is received with shift.cnt greater than 14, the TCP SHOULD log the error but MUST use 14 instead of the specified value.
The timestamp clock MUST tick at least once for each 2^31 bytes sent. The clock's recycling period MUST be greater than MSL seconds; since the clock is 32 bits and worst-case MSL is 255 seconds, the maximum acceptable clock frequency is one tick every 59 ns.
The window field in a SYN or SYN-ACK segment MUST NOT be scaled. Upon receiving a SYN with WSopt containing shift.cnt=S, the TCP MUST set Snd.Wind.Shift to S and Rcv.Wind.Shift to R; otherwise, both shift values MUST be set to zero.
When multiple RTT measurements per RTT are available (due to timestamps), an implementation SHOULD try to adhere to the spirit of the history weighting specified in RFC 6298 for the RTT estimator.
When the ACK bit is set in an outgoing segment, the sender MUST echo a recently received TSval in the TSecr field. When the ACK bit is not set, TSecr SHOULD be set to zero, and the receiver MUST ignore the TSecr field.
Using the system clock as the raw source for TSval reveals characteristics of the TCP stack (notably, system uptime), enabling fingerprinting and more targeted attacks. A random per-connection offset SHOULD be applied to the clock source. Additionally, the combination, ordering, and padding of WSopt and TSopt reveal OS fingerprinting clues.
IANA updated the 'TCP Option Kind Numbers' table under 'TCP Parameters' to list RFC 7323 as the authoritative reference for 'Window Scale' (Kind=3) and 'Timestamps' (Kind=8), superseding RFC 1323.
A naive implementation deriving the timestamp clock directly from system uptime leaks system boot time to attackers. It is RECOMMENDED to add a random per-connection offset to the timestamp clock when generating TSval (see RFC 6528 for the analogous technique with ISN randomization).
Large TCP windows make it easier for an attacker to generate forged packets that fall within the window. PAWS mitigates this, but an attacker able to forge an acceptable segment could inject a future-timestamped packet causing valid segments to be dropped by PAWS. Implementations should not open the window drastically beyond connection requirements.
Middleboxes that remove the Window Scale or Timestamps option from SYN or SYN-ACK segments break protocol negotiation. Removing WSopt from SYN-ACK leaves hosts with incorrect scale factors; removing TSopt disables PAWS protection; removing TSopt from a data segment after negotiation causes the receiver to silently discard it.
The timestamp echo selection algorithm maintains two per-connection state variables: TS.Recent (latest received timestamp to be echoed) and Last.ACK.sent (last ACK field sent). TS.Recent is updated when SEG.TSval >= TS.Recent AND SEG.SEQ <= Last.ACK.sent; otherwise the incoming TSval is ignored.
The TCP Timestamps option (TSopt) has Kind=8, Length=10 bytes, and carries two 4-byte fields: TSval (current timestamp clock of the sender) and TSecr (timestamp echo reply). Total option size is 10 bytes, or up to 12 bytes with NOP padding.
The TCP Window Scale option (WSopt) has Kind=3, Length=3 bytes, and a single 'shift.cnt' byte encoding the logarithmic scale exponent (0–14) for the receive window. The maximum permissible shift count is 14, allowing windows up to 2^30 bytes (1 GiB).